SSL Expiry Status Not Reflecting Correctly

Question

Hi,

I have just renewed (created a new version) the SSL in my Key Vaults about two hours ago, but the SSL expiry status is not reflecting the latest in Application Gateway (red box).

Key Vaults

I have tried the suggestion in https://docs.azure.cn/en-us/application-gateway/renew-certificates but it is not helping.

Please advise.

Thank you.

Regards.

Answer 1

Hi @ Tai Li ,
Welcome to Microsoft Q&A Platform.

When Application Gateway is configured to use Key Vault certificates, its instances retrieve the certificate from Key Vault and install them locally for TLS termination.

The instances poll Key Vault at four-hour intervals to retrieve a renewed version of the certificate if it exists. If an updated certificate is found, the TLS/SSL certificate that's currently associated with the HTTPS listener is automatically rotated.

Ref: Renew Application Gateway certificates

Recommended approach:

• Keep the old certificate version enabled until Application Gateway reflects the new certificate expiry/thumbprint.
• Once the new version is confirmed as active on the listener, the older version can optionally be disabled or deleted.
• Application Gateway may temporarily fail to retrieve a valid certificate during the polling/rotation window.

Application Gateway uses a secret identifier in Key Vault to reference the certificates. For Azure PowerShell, the Azure CLI, or Azure Resource Manager

Microsoft strongly recommend that you use a secret identifier that doesn't specify a version. This way, Application Gateway automatically rotates the certificate if a newer version is available in your key vault. An example of a secret URI without a version is https://myvault.vault.azure.net/secrets/mysecret/.

Pleaseand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Hi Tai,

This usually happens because Application Gateway does not pick up the new Key Vault certificate version immediately. The portal expiry status can take some time to refresh even after the certificate is renewed.

Please check that the listener is using the versionless Key Vault secret URL and not a specific certificate version. If a version-specific URL is configured, App Gateway will continue using the older cert.

Also try a small update on the Application Gateway (for example adding/removing a tag and saving) to trigger a sync.

In most cases, the updated expiry reflects after the next Key Vault polling cycle.